Analysis
- max time kernel
61s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
20/12/2022, 00:54
General
- Target Stub.exe
- Size 61KB
- Sample221220-a8869sbe8v
- SHA256 32e23296c65a1fea033fbbe400eb4b33be1ba4c8541ad4caac33f7dac05b39a3
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
| Edit 3LOSH RAT
Botnet
-
Default
C2
-
wpmediatech.com:6666
Mutex
-
AsyncMutex_xe
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- Async RAT payload 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stub.exe"C:\Users\Admin\AppData\Local\Temp\Stub.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4636-132-0x00000000008B0000-0x00000000008C6000-memory.dmp
memory/4636-133-0x0000000005D30000-0x00000000062D4000-memory.dmp
memory/4636-134-0x0000000005930000-0x00000000059C2000-memory.dmp
memory/4636-135-0x0000000005910000-0x000000000591A000-memory.dmp
memory/4636-136-0x0000000006420000-0x00000000064BC000-memory.dmp
memory/4636-137-0x00000000064C0000-0x0000000006526000-memory.dmp